Logout is unauthorized except from auth.hail.is pages

[cjllanwarne]

What happened?

Reproduction steps -

• Log into batch.hail.is
• Go to the batches page
• Click Logout
• Get "401: unauthorized" message page (but user is never actually logged out)
• Go to auth.hail.is
• Click logout
• Logout succeeds

Expected:

• Successful logout from any source page

Version

Batch - 0.2.132

Relevant log output

No response

[cjllanwarne]

This is caused by domain-by-domain CSRF tokens introduced in #14180. An unfortunate side effect is that the tokens available on non-auth pages are no longer able to validate requests to the auth/logout API.

Given the lack of apparent noise about this bug in our issues and zulip I suspect that this is not a common path for users, and that a fix along the lines of "require add one button click to go to the User page first before logging out is acceptable".

On the other hand, the risk of a user clicking on the broken Logout button and believing themselves to be logged out when seeing a 401: Unauthorized page (but actually still having logged-in state in their browser) raises this in my mind to a security bug rather than just a UX bug or an unfortunate user experience.

Therefore my proposal is:

1. To fix the bug as soon as possible
2. Accept an additional redirect in a user flow which is rarely exercised
3. To make the smallest number of potentially risky changes to the underlying security architecture
4. Therefore: Remove the broken "log out" link in page headers and replace with a Log out button on the auth[...]/users page which is guaranteed to have the correct CSRF token in state.